Microsoft

Requirements authoring guide for BRD and PRD across Discover, Define, and Govern with canonical templates and handoff contracts

The English summary is being prepared. Showing the original description.

OWASP Docker Top 6 knowledge base for identifying, assessing, and remediating Docker container security risks.

The English summary is being prepared. Showing the original description.

Retrieves and groups GitHub code scanning alerts by rule and severity using the gh CLI

The English summary is being prepared. Showing the original description.

Security planning and plan-drift analysis for STRIDE, standards, controls, backlog handoff, current findings, and TM7 generation.

The English summary is being prepared. Showing the original description.

Create or resume an evidence-based RPI implementation plan with an optional independent critique. Use when a task needs an implementation plan or an existing plan needs revision.

The English summary is being prepared. Showing the original description.

OWASP Top 10 for LLM Applications (2025) knowledge base for identifying, assessing, and remediating large language model security risks.

The English summary is being prepared. Showing the original description.

Format specifications and data contracts for the security reviewer orchestrator and its subagents.

The English summary is being prepared. Showing the original description.

Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/ or a caller's trusted evidence root, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first.

The English summary is being prepared. Showing the original description.

OWASP MCP Top 10 knowledge base for identifying, assessing, and remediating Model Context Protocol security risks.

The English summary is being prepared. Showing the original description.

Shared work-item templates and conventions for ADO and GitHub backlog handoff across the RAI, Security, SSSC, Accessibility, and Privacy planners

The English summary is being prepared. Showing the original description.

OWASP Infrastructure Top 10 knowledge base for identifying, assessing, and remediating internal IT infrastructure security risks.

The English summary is being prepared. Showing the original description.

Declarative OpenTelemetry-aligned telemetry vocabulary and instrumentation conventions for traces, metrics, logs, and PII handling

The English summary is being prepared. Showing the original description.

Microsoft Cloud Security Benchmark (MCSB v2) control-domain taxonomy and NIST 800-53 / CIS Controls crosswalk for planning and reviewing Azure cloud resources.

The English summary is being prepared. Showing the original description.

Follow an approved RPI plan, keep it current as new information comes to light, check off completed work, and keep a condensed changes log. Use when implementation is ready to begin or resume.

The English summary is being prepared. Showing the original description.

OWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks.

The English summary is being prepared. Showing the original description.

Secure by Design principles knowledge base for assessing security-first design, development, and deployment across the software lifecycle.

The English summary is being prepared. Showing the original description.

OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core.

The English summary is being prepared. Showing the original description.

Consolidated Responsible AI standards reference: NIST AI RMF 1.0, AI STRIDE threat-modeling overlay, EU AI Act risk tiers, and an open-standards catalog with phase mapping

The English summary is being prepared. Showing the original description.

OWASP CI/CD Top 10 knowledge base for identifying, assessing, and remediating CI/CD pipeline security risks.

The English summary is being prepared. Showing the original description.

Guided, conversational walkthrough that explains code, UI, UX, features, or .copilot-tracking artifacts with navigable evidence links, a deep review before explaining, and a reconciled decisions-and-changes ledger. Use when the user wants to understand how something works or why it was changed.

The English summary is being prepared. Showing the original description.

Challenge a confirmed task, decision, plan, or artifact through adaptive skeptical questions. Use when you need to expose assumptions before acting.

The English summary is being prepared. Showing the original description.

OWASP Agentic Security Top 10 knowledge base for identifying, assessing, and remediating AI agent system security risks.

The English summary is being prepared. Showing the original description.

Generates PR reference XML with commit history and unified diffs between branches, with extension and path filtering. Use when creating pull request descriptions, preparing code reviews, analyzing branch changes, discovering work items from diffs, or generating structured diff summaries.

The English summary is being prepared. Showing the original description.

Compare RPI planning and implementation evidence, record review findings, and route follow-up work. Use when an implementation needs acceptance review.

The English summary is being prepared. Showing the original description.